TL;DR
- A security firm has found that hackers exploited a Chrome bug and a Qualcomm Adreno GPU driver flaw to infect Android phones that visited a booby-trapped website.
- The attack targeted Chrome versions 139 to 145 on Android and stole browser cookies, saved logins, browsing history, and Wi-Fi passwords.
- Both flaws had already been patched, so phones running up-to-date Chrome and security updates remained safe.
Security researchers at Sekoia have detailed a mobile hacking campaign that went after Android and iPhone users through hijacked and fake websites. On Android, the attackers didn’t need victims to tap a link, install an app, or grant a permission. Opening an infected page in an outdated version of Chrome was enough.
According to Sekoia’s report, the attack on Android worked in stages. First, it used a Chrome flaw tracked as CVE-2026-3910 to run code inside the browser. It then exploited CVE-2025-27038, a bug in Qualcomm’s Adreno GPU driver, to break out of Chrome’s sandbox and gain deeper access to the phone. Since Adreno graphics are found in Snapdragon chips, phones powered by Qualcomm’s silicon were the ones affected.
